A bot should close a security ticket only when independent evidence shows the finding is gone, such as a rescan on the deployed code. It should not close tickets because a pull request merged, a timer ran out, or someone said "accepted". Those need a person.
The decision table
| Situation | Bot closes? | Why |
|---|---|---|
| Rescan confirms the finding no longer appears | Yes | Evidence is objective |
| Pull request merged, no rescan yet | No | Merged is not shipped or verified |
| Ticket older than a set age | No | Age is not a fix |
| Component removed from the inventory | Yes, with a note | The risk is gone, record it |
| Risk accepted | No, a person does it | A decision needs an approver |
| Finding marked false positive | No, a person confirms | Wrong closure hides real risk |
| Duplicate of an open ticket | Yes, link to the original | Mechanical and reversible |
Rules for the bot closures you do allow
- Log the evidence, such as the scan id and the date, in the ticket.
- Use a distinct status or label so people can filter bot closures.
- Make closure reversible: if the finding reappears, reopen the same ticket, do not create a new one.
- Sample bot closures every month. Pull ten at random and check them.
- Pause the rule if the error rate passes a threshold you set in advance.
The danger of stale closure rules
"Close after 90 days of no activity" is a common rule and a bad one for security. It makes the dashboard look clean and the risk stays. If tickets go stale, the cure is ownership and escalation, not deletion. See stale security tickets: close, fix or accept.
Start in report only mode
Run the closing rule for a few weeks writing a comment such as "would close" without changing anything. Compare against what humans decide. Turn on closing once the two agree. The same idea is covered in shadow mode for automated remediation.
Quick check
Is a merged fix pull request enough to close the ticket?
No. Wait for a rescan that confirms the finding is gone from the deployed version.
Should old tickets be closed automatically?
No. Age does not change risk. Escalate or decide on them instead.
Safeguard can rescan after a fix pull request, and its autonomous remediation is off by default with every category on Manual. Try a free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
